Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
cfc66e5038bbed90a973ce6ee6f72918ae9ad66ed14af3eed8cf23167ede5c6f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cfc66e5038bbed90a973ce6ee6f72918ae9ad66ed14af3eed8cf23167ede5c6f.exe
Resource
win10v2004-20240221-en
Target
cfc66e5038bbed90a973ce6ee6f72918ae9ad66ed14af3eed8cf23167ede5c6f
Size
4.1MB
MD5
ebb882fc8e97129623e49cbe1ce4881e
SHA1
1c97a4aa5b5226d7945bd6f71542cae9a9896b4a
SHA256
cfc66e5038bbed90a973ce6ee6f72918ae9ad66ed14af3eed8cf23167ede5c6f
SHA512
a9ece15ae9a5b79360c3ee65ad6fcaa36c27aec9c8c2fb8e36aa212b8afae67f26dea5d5832dc29ae44a222706cfa50b14f626bed23310898b0e179fc29e08fc
SSDEEP
49152:X3w5mxLbAuKrolKghNrSnSD50vQ/qpyr0kb8N4I58gC3EaKamYPTtb8LI5u4MqH9:w5mLbaSivQ/qpyr0ku4IO/323qtbwpqd
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
UuidCreate
FwpmSubLayerAdd0
FwpmSubLayerDeleteByKey0
FwpmEngineOpen0
FwpmFilterAdd0
FwpmEngineClose0
FwpmFilterDeleteById0
gethostname
WSAEventSelect
WSAEnumNetworkEvents
WSACloseEvent
WSAAddressToStringW
connect
WSAIoctl
getpeername
getaddrinfo
WSASetLastError
WSACleanup
setsockopt
WSAGetLastError
WSASend
WSAStartup
ioctlsocket
htons
htonl
ntohs
send
recv
inet_ntoa
ntohl
sendto
recvfrom
WSARecv
inet_addr
inet_pton
inet_ntop
__WSAFDIsSet
socket
bind
select
accept
listen
closesocket
getsockopt
freeaddrinfo
shutdown
getsockname
WSAStringToAddressA
WSACreateEvent
WSASocketW
GetAdaptersInfo
NotifyAddrChange
GetIpForwardTable2
NotifyUnicastIpAddressChange
GetIpForwardTable
FreeMibTable
GetAdaptersAddresses
DeleteIpNetEntry
CreateIpNetEntry
SetIpNetEntry
GetExtendedTcpTable
pcap_open_live
pcap_dump_close
pcap_dump_open
pcap_activate
pcap_sendpacket
pcap_set_promisc
pcap_open_dead
pcap_geterr
pcap_loop
pcap_close
pcap_compile
pcap_setdirection
pcap_breakloop
pcap_freecode
pcap_setmintocopy
pcap_setfilter
pcap_create
PacketGetVersion
PacketReceivePacket
PacketSetReadTimeout
PacketSetMinToCopy
PacketSetBuff
PacketAllocatePacket
PacketSendPacket
PacketSetHwFilter
PacketFreePacket
PacketInitPacket
PacketOpenAdapter
PacketCloseAdapter
PacketGetNetInfoEx
PacketRequest
PacketGetAdapterNames
CoUninitialize
CoSetProxyBlanket
CoCreateInstance
CoInitializeEx
PathRemoveFileSpecA
PathFileExistsA
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord217
ord143
ord79
ord30
ord200
ord301
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
IdnToAscii
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
GetFileSizeEx
CreateFileA
WaitForSingleObjectEx
GetEnvironmentVariableA
PeekNamedPipe
ReadFile
QueryPerformanceFrequency
InitializeCriticalSectionEx
SystemTimeToFileTime
GetSystemTime
SetConsoleMode
ReadConsoleW
ReadConsoleA
GetConsoleMode
FindNextFileW
FindFirstFileW
ConvertThreadToFiber
ConvertFiberToThread
QueryPerformanceCounter
LoadLibraryW
FormatMessageW
CreateFiber
DeleteFiber
SwitchToFiber
MultiByteToWideChar
GetModuleHandleW
WriteFile
GetFileType
GetStdHandle
GetCurrentThreadId
GetModuleHandleExW
GetCurrentProcessId
ReleaseMutex
CreateMutexW
GetSystemTimeAsFileTime
DeviceIoControl
K32EnumProcesses
GetTempFileNameA
GetExitCodeProcess
K32GetModuleFileNameExA
OpenProcess
MoveFileExA
lstrlenA
ResetEvent
GetModuleFileNameA
LoadLibraryA
GetProcessHeap
GetTickCount
HeapFree
HeapAlloc
FreeLibrary
CreateEventA
CreateWaitableTimerA
CloseHandle
GetModuleHandleA
CreateIoCompletionPort
WaitForMultipleObjects
CreateEventW
QueueUserAPC
GetProcAddress
SetLastError
VerifyVersionInfoA
InitializeCriticalSectionAndSpinCount
TerminateThread
WideCharToMultiByte
TlsSetValue
SleepEx
SetEvent
WaitForSingleObject
VerSetConditionMask
GetQueuedCompletionStatus
SetWaitableTimer
TlsGetValue
DeleteFileA
FindNextFileA
FindClose
FindFirstFileA
GetSystemDirectoryA
TerminateProcess
GetCurrentProcess
Sleep
TlsFree
LocalFree
FormatMessageA
LeaveCriticalSection
GetLastError
EnterCriticalSection
PostQueuedCompletionStatus
DeleteCriticalSection
TlsAlloc
GetEnvironmentVariableW
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
CryptEncrypt
CryptImportKey
CryptHashData
CryptGetHashParam
CryptAcquireContextA
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegCloseKey
ControlService
OpenSCManagerA
QueryServiceStatusEx
RegCreateKeyExA
EnumDependentServicesA
RegSetValueExA
CloseServiceHandle
OpenServiceA
SysFreeString
SafeArrayGetElement
SafeArrayDestroy
SysAllocStringByteLen
VariantClear
SysAllocString
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?_Xinvalid_argument@std@@YAXPBD@Z
_Xtime_diff_to_millis2
_Thrd_sleep
?toupper@?$ctype@D@std@@QBEDD@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ
_Mtx_lock
_Mtx_unlock
?classic@locale@std@@SAABV12@XZ
?_BADOFF@std@@3_JB
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Throw_C_error@std@@YAXH@Z
_Mtx_destroy
_Mtx_init
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
xtime_get
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?clog@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?swap@?$basic_ostream@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
_Thrd_equal
?_Throw_Cpp_error@std@@YAXH@Z
?_Release@_Pad@std@@QAEXXZ
?_Launch@_Pad@std@@QAEXPAU_Thrd_imp_t@@@Z
??1_Pad@std@@QAE@XZ
??0_Pad@std@@QAE@XZ
_Thrd_join
_Thrd_current
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?_Random_device@std@@YAIXZ
_Xtime_get_ticks
??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?tolower@?$ctype@D@std@@QBEDD@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??_7_Facet_base@std@@6B@
_Strxfrm
??_7facet@locale@std@@6B@
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Future_error_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?id@?$collate@D@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
_Strcoll
GetAcceptExSockaddrs
AcceptEx
strchr
memchr
realloc
exit
fputc
_unlock_file
ungetc
fgetpos
_fseeki64
fflush
_errno
fgetc
strtol
fsetpos
printf
setvbuf
_lock_file
memcpy_s
fwrite
fclose
sprintf
__iob_func
fputs
fprintf
strerror
strncpy
strncmp
strpbrk
calloc
_strdup
isspace
atoi
tolower
_gmtime64
rand
srand
_time64
_mktime64
_localtime64
??8type_info@@QBE_NABV0@@Z
_localtime64_s
_beginthreadex
strftime
strtoul
?wait@Concurrency@@YAXI@Z
?_Id@_CurrentScheduler@details@Concurrency@@SAIXZ
_vsnprintf
rename
_unlink
_getpid
feof
_open
fgets
_read
fopen
fread
_fileno
ferror
_setmode
ftell
_lseek
_write
fseek
clearerr
_close
_ftime64
rewind
swprintf_s
_stricmp
strrchr
memcpy
memset
qsort
strerror_s
getenv
strcmp
_exit
_vsnwprintf
wcsstr
raise
strcspn
strspn
_gmtime64_s
_strnicmp
_wfopen
sscanf
_stat64i32
strstr
__CxxFrameHandler3
_CxxThrowException
_access
_stat64
strtoll
_lseeki64
_fstat64
__sys_nerr
wcstombs
isupper
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__initenv
_fmode
_commode
_except1
_except_handler4_common
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
_local_unwind4
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
sprintf_s
memmove
free
malloc
signal
_wassert
??_V@YAXPAX@Z
_purecall
??3@YAXPAX@Z
?terminate@@YAXXZ
??2@YAPAXI@Z
OPENSSL_Applink
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ